Renegotiations in 0.9.7 IO on SSL Connections
5.2.3.2 Renegotiations in 0.9.7
Overall, renegotiation in Version 0.9.6 is inferior to the functions and simplicity that Version 0.9.7 promises. A new function has been added, SSL_regenotiate_pending . This function will return nonzero if a request is sent, but the handshake hasnt been finished. It will return zero once the handshake is complete. Using this function, we can eliminate most of the ugliness associated with renegotiations in 0.9.6. Before looking at forced renegotiations, well briefly return to passive renegotiations. In most applications, renegotiations for changing the session key rather than upgrading client authentication are started by byte transfer thresholds. In other words, once our connection has transferred a certain number of bytes, we will renegotiate. Because of this new function, we can simply call SSL_renegotiate when the byte limit is reached. Then we periodically check the value of SSL_renegotiate_pending to determine if the renegotiation completed. Doing this, we can programmatically fail if the handshake isnt completed in a certain amount of time after the request. Furthermore, a new SSL option to aid us has been added in Version 0.9.7. By setting SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION with a call to SSL_CTX_set_options , we can automatically prevent clients from being able to resume sessions when we ask for renegotiations, regardless of the session ID context. When our goal is to refresh session keys, this option is invaluable. Using these two new additions will also allow us to make a much cleaner forced renegotiation for client authentication. We can call SSL_renegotiate to set the flag and make a single call to SSL_do_handshake to send the request out. Instead of setting internal state of the SSL object, we can now just call SSL_do_handshake until we either programmatically timeout or SSL_renegotiate_pending returns zero. If the latter condition is met, our renegotiation completed successfully. Ideally, we want to leave the session ID context changing and not set the new SSL option when performing renegotiation for client authentication. This is better because it allows authenticated users to resume authenticated sessions rather than always perform the full handshake.5.2.3.3 Further notes
Parts
» Network Security With OpenSSL 2002
» Goals of Cryptography Cryptography for the Rest of Us
» Symmetric key encryption Cryptographic Algorithms
» Public key encryption Cryptographic Algorithms
» Cryptographic hash functions and Message Authentication Codes
» Overview of SSL Introduction
» Cryptographic acceleration hardware Load balancing
» Bad Server Credentials Problems with SSL
» Certificate Validation Problems with SSL
» Poor Entropy Problems with SSL
» Insecure Cryptography Problems with SSL
» Other Transport Layer Protocols Non-Repudiation Protection Against Software Flaws
» Server-Side Proxies Securing Third-Party Software
» Client-Side Proxies Securing Third-Party Software
» Configuration Files The Basics
» Passwords and Passphrases Command-Line Interface
» Seeding the Pseudorandom Number Generator
» Private Certification Authorities Public Certification Authorities
» Certificate Revocation Lists Certificates
» Online Certificate Status Protocol
» Personal Certificates Obtaining a Certificate
» Code-Signing Certificates Obtaining a Certificate
» Web Site Certificates Obtaining a Certificate
» Creating an Environment for Your Certification Authority
» Building an OpenSSL Configuration File
» Creating a Self-Signed Root Certificate
» Revoking Certificates Setting Up a Certification Authority
» Static Locking Callbacks Multithread Support
» Dynamic Locking Callbacks Multithread Support
» Manipulating Error Queues Internal Error Handling
» Human-Readable Error Messages Internal Error Handling
» Threading and Practical Applications
» Memory sourcessinks File sourcessinks
» Socket sourcessinks SourceSink BIOs
» Filter BIOs Abstract InputOutput
» Seeding the PRNG Random Number Generation
» Using an Alternate Entropy Source
» The Basics Arbitrary Precision Math
» Mathematical Operations Arbitrary Precision Math
» Generating Prime Numbers Arbitrary Precision Math
» Using Engines Support Infrastructure
» Background Step 1: SSL Version Selection and Certificate Preparation
» Certificate preparation Step 1: SSL Version Selection and Certificate Preparation
» Our example extended Step 1: SSL Version Selection and Certificate Preparation
» Background Incorporating trusted certificates
» Certificate verification Step 2: Peer Authentication
» Incorporating certificate revocation lists
» Post-connection assertions Step 2: Peer Authentication
» Further extension of the examples
» Setting SSL options Step 3: SSL Options and Cipher Suites
» Ephemeral keying Step 3: SSL Options and Cipher Suites
» Cipher suite selection Step 3: SSL Options and Cipher Suites
» The final product Step 3: SSL Options and Cipher Suites
» Beyond the example Step 3: SSL Options and Cipher Suites
» Client-side SSL sessions SSL Session Caching
» Server-side SSL sessions SSL Session Caching
» An on-disk, session caching framework
» Reading and writing functions
» Blocking IO IO on SSL Connections
» Non-blocking IO IO on SSL Connections
» Implementing renegotiations IO on SSL Connections
» Renegotiations in 0.9.7 IO on SSL Connections
» Further notes IO on SSL Connections
» Block Ciphers and Stream Ciphers
» AES Blowfish CAST5 Available Ciphers
» IDEA RC2™ RC4™ Available Ciphers
» Initializing Symmetric Ciphers Encrypting with the EVP API
» Specifying Key Length and Other Options
» Encryption Encrypting with the EVP API
» Decryption Encrypting with the EVP API
» Handling UDP Traffic with Counter Mode
» General Recommendations Symmetric Cryptography
» Secure HTTP Cookies Hashes and MACs
» When to Use Public Key Cryptography
» Generating and Exchanging Parameters
» Computing Shared Secrets Diffie-Hellman
» The Basics Digital Signature Algorithm DSA
» Generating Parameters and Keys
» Signing and Verifying Digital Signature Algorithm DSA
» Data Encryption, Key Agreement, and Key Transport
» Signing and Verifying The EVP Public Key Interface
» Encrypting and Decrypting The EVP Public Key Interface
» Writing and Reading DER-Encoded Objects
» Writing and Reading PEM-Encoded Objects
» Net::SSLeay Variables Net::SSLeay for Perl
» Net::SSLeay Error Handling Net::SSLeay Utility Functions
» Net::SSLeay Low-Level Bindings
» M2Crypto.SSL High-Level Classes
» Miscellaneous crypto High-Level Classes
» Extensions to httplib: httpslib
» Extensions to urllib: m2urllib Extensions to xmlrpclib: m2xmlrpclib
» General Functions OpenSSL Support in PHP
» Certificate Functions OpenSSL Support in PHP
» Encryption and Signing Functions
» PKCS7 SMIME Functions OpenSSL Support in PHP
» Object Stacks Advanced Programming Topics
» Configuration Files Advanced Programming Topics
» Subject name Generating Requests
» X.509 Version 3 extensions Putting it all together
» X.509 Certificate Checking X.509
» Signing and Verifying PKCS7 and SMIME
» Encrypting and Decrypting PKCS7 and SMIME
Show more